Description
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ivanti | Xtraction | — | 2026.2.1 |
High · 7.7
CVE-2026-14903
EUVD-2026-43684GHSA-9jjf-4p7p-4qv4
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web …
Published Jul 14, 2026 · Updated Jul 14, 2026 · Assigned by ivanti